From d4e62057452b6d6c2e6a3224481e54eb4393fc49 Mon Sep 17 00:00:00 2001
From: Unrud <unrud@openaliasbox.org>
Date: Sat, 11 Jun 2016 12:53:58 +0200
Subject: [PATCH] Don't include passwords in logs

---
 config               |  3 +++
 radicale/__init__.py | 22 +++++++++++-----------
 radicale/config.py   |  3 ++-
 3 files changed, 16 insertions(+), 12 deletions(-)

diff --git a/config b/config
index f3a3a46..eb4e578 100644
--- a/config
+++ b/config
@@ -116,6 +116,9 @@
 # Store all environment variables (including those set in the shell)
 #full_environment = False
 
+# Don't include passwords in logs
+#mask_passwords = True
+
 
 [headers]
 
diff --git a/radicale/__init__.py b/radicale/__init__.py
index 51bb34c..d677dff 100644
--- a/radicale/__init__.py
+++ b/radicale/__init__.py
@@ -119,20 +119,20 @@ class Application:
         self.Collection = storage.load(configuration, logger)
         self.authorized = rights.load(configuration, logger)
         self.encoding = configuration.get("encoding", "request")
-        if configuration.getboolean("logging", "full_environment"):
-            self.headers_log = lambda environ: environ
 
-    # This method is overriden in __init__ if full_environment is set
-    # pylint: disable=E0202
-    @staticmethod
-    def headers_log(environ):
-        """Remove environment variables from the headers for logging."""
+    def headers_log(self, environ):
+        """Sanitize headers for logging."""
         request_environ = dict(environ)
-        for shell_variable in os.environ:
-            if shell_variable in request_environ:
-                del request_environ[shell_variable]
+        # Remove environment variables
+        if not self.configuration.getboolean("logging", "full_environment"):
+            for shell_variable in os.environ:
+                request_environ.pop(shell_variable, None)
+        # Mask credentials
+        if (self.configuration.getboolean("logging", "mask_passwords") and
+                request_environ.get("HTTP_AUTHORIZATION",
+                                    "").startswith("Basic")):
+            request_environ["HTTP_AUTHORIZATION"] = "Basic **masked**"
         return request_environ
-    # pylint: enable=E0202
 
     def decode(self, text, environ):
         """Try to magically decode ``text`` according to given ``environ``."""
diff --git a/radicale/config.py b/radicale/config.py
index 71a315b..eae9116 100644
--- a/radicale/config.py
+++ b/radicale/config.py
@@ -63,7 +63,8 @@ INITIAL_CONFIG = {
     "logging": {
         "config": "/etc/radicale/logging",
         "debug": "False",
-        "full_environment": "False"}}
+        "full_environment": "False",
+        "mask_passwords": "True"}}
 
 
 def load(paths=()):